# Miro SCIM provisioning from Google Workspace

> Provision Miro users and user groups from Google Workspace with Miro SCIM on the Enterprise plan. SSO prerequisite, SCIM token and AnySCIM setup.

**Miro supports SCIM provisioning on the Enterprise plan, once SSO/SAML is enabled.** You generate a SCIM token in Miro's company settings, and AnySCIM uses it with `https://miro.com/api/v1/scim` to create Miro accounts for people in Google Workspace, sync Google groups to Miro user groups and deactivate people who leave.

## Requirements

- A **Miro Enterprise** plan.
- **SSO/SAML** enabled in Miro. Google Workspace can be the SAML identity provider through a custom SAML app.
- A Miro admin with access to **Company settings**, to generate the token.
- A Google Workspace source already connected. See [Connect Google Workspace](/docs/google-workspace).

## Generate the Miro SCIM token

1. In Miro, open **Company settings → Enterprise integrations** and check that **SSO/SAML** is enabled.
2. In the **SCIM Provisioning** section, click **Generate new token**, then **Generate**.
3. Copy the token. It grants access to every account in your Miro company, so store it like a password.

> **Tip:** if you generate a new token later, update the connection in AnySCIM with it straight away, as you would in any other identity provider.

## Connect Miro in AnySCIM

1. Open **Connections → New connection** and choose **Miro**.
2. The base URL is pre-filled with `https://miro.com/api/v1/scim`. Paste the token and click **Test connection**.
3. In **Scope**, select the groups or organizational units that should have Miro. Turn on **Push group membership** to create Miro user groups from Google groups.
4. Review the dry-run, then click **Activate connection**.

## How users are synced

- New users in scope get a Miro account, matched by email. Miro uses the email address as the SCIM `userName`.
- Name, title and department changes are pushed with `PATCH`.
- A suspended Google user is set to `active: false`, which makes the Miro account inactive instead of deleting it.
- Google groups become Miro user groups. Assign a user group to a Miro team and its members join the team, so team access follows your Google groups.
- Users found in Miro but no longer in scope are left alone by default. In **Settings → When a user is deleted** you can choose to deactivate or delete them instead.

## Troubleshooting

- **401 on every request:** the token was regenerated or revoked. Paste the current token into the connection.
- **Test fails before SSO is set up:** Miro only offers SCIM once SSO/SAML is enabled. Finish the SSO setup first.
- **A user can't sign in after being provisioned:** check that the Google Workspace email AnySCIM sends as `userName` is the same email your SAML app sends at sign-in.

## FAQ

### Which Miro plan supports SCIM?

The Enterprise plan. SCIM is configured in **Company settings → Enterprise integrations** and requires SSO/SAML to be enabled first.

### Does deactivating a user in Google delete them from Miro?

No. AnySCIM sends `active: false`, which deactivates the Miro account. Deletion only happens if you choose **Delete** for users removed from the scope.

### Can Google groups manage Miro team membership?

Yes. With **Push group membership** enabled, each Google group becomes a Miro user group. Assign that user group to a team in Miro and its members are added to the team.